Exporting Log Data
Seq uses a newline-delimited JSON format for import and export of log data.
Log data can be exported from a Seq server in one of three ways.
Export via the API with seqcli search --json
seqcli search --json
The seqcli
command-line client is usually the nicest way to work.
Events are exported using seqcli search
with the --json
argument specified:
seqcli search -c 1000000000 --json --filter="Application = 'Ordering'"
The command accepts a variety of arguments to control which data is exported (run seqcli help search
to see them all).
Events are written to STDOUT
; to save them to a file, use redirection:
seqcli search -c 1000000000 --json --filter="Application = 'Ordering'" > ordering.clef
seqcli
is installed and placed on the path by default when installing Seq on Windows. Other downloads and documentation are at: https://github.com/datalust/seqcli.
The tool is built on the HTTP API and the underlying code is in the Seq.Api NuGet package (C#), so if your task is programmatic that can be used directly instead.
Export in real-time using Seq.App.JsonArchive
Another alternative, if it's an ongoing process, is to install the Seq.App.JsonArchive extension and set up a continuous JSON export into a shared folder.
The app will export newline-formatted JSON files in a configurable chunk size.
With the app installed, configure an instance with the Stream incoming events option to export event data as it arrives.
Bulk export using flaretl.exe
flaretl.exe
The flaretl
tool, installed to C:\Program Files\Seq\Native
on Windows, and included at /bin/seq-server/Native
in the Docker container, is the fastest way to export events (one or more orders of magnitude faster than the other options).
Unlike the first two possibilities, flaretl
requires that the store is "cold", that is, the Seq server is stopped and no other process is accessing the stream data.
seq service stop
& "C:\Program Files\Seq\Native\flaretl.exe" export "C:\ProgramData\Seq\Stream" > export.clef
seq service start
Updated almost 3 years ago